Polish Authorities Arrest Suspected Russian Hacker Targeting Local Organizations

Polish law enforcement has detained a Russian national accused of hacking into an online store’s systems, marking a significant win against cross-border cybercrime.

On November 16, 2025, officers from the Central Bureau for Combating Cybercrime (CBCB) in Krakow arrested the suspect during an investigation led by the Krakow District Prosecutor’s Office, Economic Crime Department, Cybercrime Division.

The announcement came on November 26, 2025.

The individual, who illegally entered Poland in 2022 and gained refugee status in 2023, allegedly bypassed security controls to access a Polish e-commerce platform without authorization.

Investigators gathered evidence showing he exploited vulnerabilities to infiltrate the teleinformation system, including its databases, and tampered with their structure.

After formal charges and interrogation, prosecutors requested three months of pre-trial detention from the Krakow-Śródmieście District Court, which approved it.

This case highlights rising threats to small and medium enterprises, as online stores often run outdated software that is vulnerable to common attack vectors.

Unauthorized Access Tactics In E-Commerce Breaches

Cyber forensics revealed that the suspect breached perimeter defenses, likely using techniques prevalent in Eastern European threat actor playbooks.

E-commerce platforms, typically built on frameworks such as WooCommerce, Magento, or custom PHP backends, expose risks due to weak authentication.

Attackers often deploy SQL injection to extract user data from MySQL databases or exploit unpatched CMS plugins such as those with CVE-2023-28121 in WooCommerce, allowing arbitrary file uploads.

Once inside, the intruder manipulated database schemas, potentially altering product listings, customer records, or inventory tables.

This “interference in structure” could involve injecting malicious SQL commands like ALTER TABLE users ADD COLUMN is_admin BOOLEAN DEFAULT TRUE, granting elevated privileges.

Such actions enable data exfiltration, ransomware deployment, or sabotage, causing operational downtime and financial loss.

Tools like SQLmap or Metasploit facilitate automated reconnaissance and exploitation by scanning for endpoints such as/admin/login.php or exposed /wp-admin/ directories.

Polish authorities noted that the suspect operated without the store owner’s consent, emphasizing the breach’s unauthorized nature under Article 267 of Poland’s Penal Code, which penalizes unauthorized access to an IT system with up to 5 years’ imprisonment.

Broader Implications For EU Targets

Prosecutors suspect links to additional attacks on Polish and EU firms, with ongoing verification of damages.

This aligns with trends among Russian-affiliated hacking groups, as tracked by CISA, which target supply chains for espionage or disruption.

Victims may face data leaks through unsecured APIs or misconfigured cloud storage, amplifying GDPR-related risks.

The case remains active, with CBCB collaborating on threat intelligence sharing.

Businesses are urged to audit access logs, enforce multi-factor authentication (MFA), and patch vulnerabilities using tools such as Nessus. This arrest underscores Poland’s proactive cyber defense amid geopolitical tensions.